# Dependency reports

Luci job `dependencies` is configured for 04:00 UTC daily, publishing successful runs under `smith/dependencies/<revision>/` after deployment.

Published evidence contains the report, audit, and all three resolution logs with explicit exit-status files.

For a current local report, run `cargo x deps`; `cargo x deps --offline` uses cached registry evidence only and cannot establish upstream freshness.

Downstream resolution checks run with `cargo x deps --verify locked`, `cargo x deps --verify fresh-compatible`, or `cargo x deps --verify direct-minimum`; append `-p smith-core` to scope any check to one runtime library, and `--target <triple>` to check a supported target (either option may come first).

`locked` checks selected workspace libraries against checkout `Cargo.lock`; without `-p`, it selects exactly the eight runtime libraries.
Consumer modes create isolated path-based consumers under OS temporary space, deliberately generate consumer lockfiles, then check `--locked`, leaving checkout lock untouched.
`--target` applies only to Cargo check, never lockfile generation; output names actual checked target.

`fresh-compatible` proves Cargo can resolve current compatible requirements; `direct-minimum` asks installed nightly Cargo to resolve each direct registry dependency from its original requirement using `-Zdirect-minimal-versions`, leaving transitive engine resolution to Cargo.

`direct-minimum` requires an installed nightly Rust toolchain; the command never installs one, and checks the resulting lockfile with stable Cargo.

Without `--target`, resolution checks explicitly compile the Cargo host target, overriding ambient `CARGO_BUILD_TARGET`; retaining target-specific declarations does not prove other targets.
Choose an installed target supported by the selected dependencies and toolchain; the command does not install targets.

Luci job `dependency-targets` is configured for 04:30 UTC daily after deployment, publishing successful evidence under `smith/dependency-targets/<revision>/<target>/`.
All three modes check all eight runtime libraries on Linux ARM64, plus `smith-core` consumers on Windows/macOS x86_64 and ARM64.
Linux ARM64 setup supplies its cross C compiler and libc headers inside CI container only.
Windows/macOS full-library graphs still require their native C toolchains; core-only success is not full-target success.
Cross-target Cargo checks prove compilation, not binary linking, runtime behavior, or frontend usability.
Failure artifacts retain each attempted mode's log and exit status.

Windows ARM64 minimum regression requires fs2 0.4.3: older fs2 releases use winapi 0.2, which lacks ARM64 pointer types.

Host resolution does not verify guest tooling; guest build and component loading remain separate gates.

Failed CI runs retain `target/dependencies/` as failure evidence, but do not publish a successful site report.